Top Spoofed Brands Used in Quishing Attacks

Cybercriminals increasingly target well-known brands to exploit the trust users place in them.

Quishing attacks take this further by embedding malicious QR codes into phishing campaigns, redirecting users to fraudulent websites, or prompting them to download malware. As a result, businesses face severe consequences, including financial losses, reputation damage, and operational disruptions.

In this blog, we’ll explore the most spoofed brands targeted in quishing attacks, what quishing is, how it works, its impact, and how Keepnet’s Quishing Simulation and security awareness training helps protect against these sophisticated threats.

What Are Quishing Attacks?

Quishing is a phishing tactic that uses malicious QR codes to deceive users. These codes, often embedded in emails, posters, or digital platforms, redirect victims to fraudulent websites or initiate malware downloads.

What makes quishing especially dangerous is its frequent use of brand spoofing. Attackers impersonate trusted brands, leveraging their credibility to lower suspicion and increase the likelihood of success. For example, a fake QR code might mimic a login page for a well-known service like Microsoft or Google, tricking users into providing sensitive information.

By exploiting the trust in QR codes for payments and logins, combined with brand recognition, quishing attacks bypass traditional security filters and rely heavily on human error. This highlights the critical need for security awareness training and robust defenses.

To learn more about what is quishing and how it deceives people, check out our blog.

Watch Keepnet’s video featuring the real story of a QR code attack in action.

Editor's Note: This article was updated on March 12, 2026.

How Quishing Works

Quishing is particularly effective because QR codes are often trusted by users. Understanding how quishing works is important to identifying and preventing this growing threat.

Here’s how it works:

Fake QR Codes

Attackers design QR codes mimicking trusted brands and place them in phishing emails or promotional materials. See the example below to check how QR codes disguise like a real brand:

2. Scanning Deception

Victims scan the codes, believing they are legitimate. See the example video below to learn how they make people believe they are legitimate.

3. Phishing or Malware

The codes redirect users to fake websites to steal credentials or trigger malware downloads. ​​One unique use case of quishing involves targeting employees of a financial institution through cleverly placed QR codes in parking lots near their offices.

Attackers might print these codes on stickers that mimic promotional offers for nearby cafes or parking discounts. For instance, a QR code might claim to redirect to a "secure payment portal" to receive a 50% parking fee reduction. Once scanned, the QR code directs the victim to a fake corporate login page disguised as their organization's secure VPN portal.

Employees, believing the site to be legitimate, enter their credentials, giving attackers access to the institution's internal systems. Alternatively, the QR code could trigger the download of a malware-laden app, compromising the device and potentially the network it connects to. This method leverages convenience and time-sensitive incentives to bypass users' usual caution, making it highly effective against even security-conscious individuals.

The Growing Threat of Quishing Attacks

QR phishing keeps growing. Microsoft blocked 7.6 million QR phishing attempts in January 2026 and 18.7 million in March, an increase of 146% in one quarter (Microsoft, Email threat landscape: Q1 2026, 30 April 2026; email threats detected by Microsoft Defender, not a global census).

Check out our blog on Quishing Statistics if you want to see more detailed trends and learn how quishing has evolved.

Why Big Brands Are Prime Targets in Quishing Attacks

Cybercriminals increasingly focus on spoofing popular brands in quishing attacks due to the trust and familiarity these companies command. This strategy exploits both psychological and technical vulnerabilities to achieve higher success rates.

1. Broad User Base = More Victims

Global brands like Amazon, Microsoft, and Google serve millions of users, making them a lucrative target. A single quishing campaign spoofing such brands can potentially deceive thousands, amplifying the attacker’s reach and impact.

2. Trust in Familiarity

Users inherently trust well-known brands, making them less likely to scrutinize QR codes or communications that appear to originate from these companies. Cybercriminals exploit this trust to bypass skepticism and lure users into scanning malicious QR codes.

Example Quishing Case

According to The Sun US, a woman in Singapore fell victim to a quishing attack after scanning a QR code advertising free bubble tea. The malicious code directed her to download a fraudulent app, allowing attackers to steal $20,000 from her bank account. This case highlights how brand spoofing in quishing campaigns effectively lowers users' defenses.

By leveraging trusted brands, quishing attackers significantly increase their success rates, making awareness training and proactive measures critical to mitigate these risks.

Check our article to get insights on real-life quishing examples.

Most Spoofed Brands in Quishing Attacks

Current QR phishing research and law-enforcement alerts show that attackers consistently spoof familiar business brands to increase trust and drive more scans.

1. Microsoft

Microsoft is one of the brands attackers frequently imitate in QR-based phishing because users regularly expect Microsoft sign-in prompts and document workflows. FBI's 2026 QR phishing alert warns that threat actors continue to use QR codes to redirect victims to credential-harvesting pages.

Targeted Services:

Phishing campaigns typically target Office 365 and OneDrive, as these services hold sensitive business data and are essential for collaboration and productivity.

Attack Example:

Phishing emails disguised as official Microsoft notifications often include fake QR codes to deceive users. Here’s how a common attack works:

1. The Bait: The victim receives an email with a subject like “Action Required: Your Microsoft Account Session Expired.” The email instructs them to scan a QR code to re-login.
2. The Deception: Scanning the QR code redirects the victim to a counterfeit Microsoft login page designed to look legitimate.
3. The Trap: The victim enters their login credentials, which are then stolen by the attackers.

This tactic effectively combines urgency and trust to manipulate victims into providing sensitive information.

Impact:

Stolen credentials can give attackers access to emails, files, and sensitive business data stored in Office 365 or OneDrive. This can lead to data breaches, financial losses, and reputational harm for organizations.

2. DocuSign

DocuSign is also a natural lure because users associate it with urgent document review and signature requests, which lowers suspicion when a malicious QR code claims to open an agreement or invoice.

Targeted Services:

Phishing campaigns focus on DocuSign’s digital document signing and approval services, which are widely used for business transactions and legal processes.

Attack Example:

Phishing emails posing as DocuSign notifications often include malicious QR codes to exploit user trust. Here’s how a typical attack works:

1. The Bait: The victim receives an email titled “Urgent: Sign Your Document” or “Action Needed: Pending Approval.” The email contains a QR code, claiming it will take them directly to the document.
2. The Deception: Scanning the QR code redirects the victim to a fraudulent DocuSign login page that looks authentic.
3. The Trap: The victim enters their credentials or other sensitive information, which attackers then harvest for unauthorized access or further attacks.

Impact:

Successful attacks allow cybercriminals to access sensitive documents, steal login credentials, and potentially compromise financial or legal data, leading to significant business risks.

3. Adobe

Adobe-themed QR phishing works for the same reason: attackers borrow the look and feel of trusted document workflows to persuade users to authenticate or download a file without slowing down to verify the source.

Targeted Services:

Attackers primarily target Adobe’s Creative Cloud and PDF services, which are widely used for document management and creative work.

Attack Example:

Emails pretending to be from Adobe frequently include malicious QR codes. Here’s how these attacks work:

1. The Bait: Victims receive an email with a subject like “Subscription Expiration” or “Account Locked – Verify Now.” The email contains a QR code, urging users to scan it to renew their subscription or regain access.
2. The Deception: Scanning the QR code redirects victims to a fraudulent Adobe login or payment page that looks authentic.
3. The Trap: Victims enter their credentials or payment information, which are stolen by attackers for unauthorized use or financial theft.

Impact:

These attacks can lead to stolen accounts, unauthorized access to Adobe services, and theft of sensitive payment information, causing both financial losses and reputational damage.

The Business Impact of Quishing Attacks

Quishing attacks, which use malicious QR codes, have serious implications for businesses, leading to financial losses, reputational harm, and operational disruptions.

1. Financial Losses

Stolen credentials and card details lead to fraudulent payments, account takeover and the cost of recovery.

2. Reputational Damage

The erosion of trust caused by such incidents can result in customer attrition and long-term harm to brand value.

3. Operational Disruptions

Quishing attacks impose substantial operational costs, including those for incident response, IT recovery, and security enhancements.

How Keepnet Mitigates Quishing Risks

Keepnet's Quishing Simulator lets security teams test employees against the brand spoofing patterns above.

Realistic Quishing Simulations

Keepnet’s Quishing Simulator replicates real-world spoofing scenarios to test employees’ ability to identify fake QR codes.

• Spoofing Simulation: Tests employee readiness by simulating QR codes that impersonate brands like Microsoft or Amazon.
• Performance Insights: Tracks how users respond to spoofing attempts, providing actionable insights to enhance training.

Watch the video below to learn more details about Keepnet Quishing Simulator.

Learn more how you can launch a simulated QR phishing attack to check your employees on our guide.

Check out our article to get further insights into how to detect Quishing Attacks and protect your organization.